--- title: Broadcom Introduces TrueSource for Open-Source Software... description: Broadcom launched TrueSource, a suite of enterprise support and security services for open-source software, announced at VMware Explore 2026. It comprises... canonical: https://daily.dev/posts/broadcom-introduces-truesource-for-open-source-software-security-op8y9uxa1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Broadcom Introduces TrueSource for Open-Source Software Security | daily.dev og:description: Broadcom launched TrueSource, a suite of enterprise support and security services for open-source software, announced at VMware Explore 2026. It comprises... og:url: https://daily.dev/posts/broadcom-introduces-truesource-for-open-source-software-security-op8y9uxa1 og:image: https://api.daily.dev/og/posts/oP8y9uXa1.png og:image:alt: Broadcom Introduces TrueSource for Open-Source Software Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Broadcom Introduces TrueSource for Open-Source Software Security **[SD Times](https://daily.dev/sources/sdtimes)** · 3 min read · 0 upvotes · 0 comments ## Summary Broadcom launched TrueSource, a suite of enterprise support and security services for open-source software, announced at VMware Explore 2026. It comprises three parts: Spring Enterprise, offering hand-verified security patches for Spring across all supported release lines independent of version upgrades; TrueSource Trusted Artifacts, providing secure verified builds for Java, Python, and Node.js libraries plus hardened container images like Bitnami; and TrueSource Data Services, covering PostgreSQL, RabbitMQ, MySQL, and Valkey with validated distributions and operational support. Broadcom argues human-verified patching is safer than full automation, citing 1Password's Off-by-1 Labs research showing only 26% of 6,000 AI-generated patches successfully fixed issues without introducing errors. The offerings are sold via tiered site licensing. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of AI-generated security patches actually fixed the vulnerability without breaking anything else? Only 26 percent of AI-generated patches successfully fixed the security issue without causing other application errors, according to research from 1Password's Off-by-1 Labs that tested 6,000 AI-generated patches. Broadcom cited this finding to argue that current AI tools are not yet reliable enough to replace human oversight in critical security patching tasks. _Teams weighing AI-driven versus human-verified patching workflows can track findings like this on daily.dev._ ### What is Broadcom's TrueSource product for open-source software security? TrueSource is a Broadcom software suite announced at VMware Explore 2026 that provides enterprise support and human-verified security for open-source dependencies. It has three parts: Spring Enterprise for hand-checked Spring patches issued per release line, TrueSource Trusted Artifacts covering Java, Python, Node.js libraries and hardened container images like Bitnami, and TrueSource Data Services for PostgreSQL, RabbitMQ, MySQL, and Valkey. _Developers evaluating enterprise open-source support options can follow suites like TrueSource on daily.dev._ ### Why does Spring Enterprise issue security patches separately from full version upgrades? Spring Enterprise decouples security patches from full version upgrades so security teams can apply fixes in hours rather than weeks, avoiding extensive regression testing cycles. Patches are verified by hand and released simultaneously across every supported release line, often before a vulnerability is publicly disclosed, so no version is left unpatched. _Spring maintainers balancing patch speed against testing overhead can keep up with changes like this via daily.dev._ ## Similar posts on daily.dev - [Broadcom beefs up Spring security to protect against AI-enabled attacks](https://daily.dev/posts/broadcom-beefs-up-spring-security-to-protect-against-ai-enabled-attacks-uechdznsp) · InfoWorld · 0 upvotes · 0 comments - [Broadcom Aims to Better Secure Spring Applications in the AI Era](https://daily.dev/posts/broadcom-aims-to-better-secure-spring-applications-in-the-ai-era-rdqwnj8ef) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#spring](https://daily.dev/tags/spring), [#vmware](https://daily.dev/tags/vmware) [View this post on daily.dev](https://daily.dev/posts/broadcom-introduces-truesource-for-open-source-software-security-op8y9uxa1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Broadcom Introduces TrueSource for Open-Source Software Security","url":"https://daily.dev/posts/broadcom-introduces-truesource-for-open-source-software-security-op8y9uxa1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/broadcom-introduces-truesource-for-open-source-software-security-op8y9uxa1"},"datePublished":"2026-08-31T16:24:02.442Z","dateModified":"2026-08-31T16:39:16.308Z","description":"Broadcom launched TrueSource, a suite of enterprise support and security services for open-source software, announced at VMware Explore 2026. It comprises...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e98a219bb8cab139c7478f64554f4519?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e98a219bb8cab139c7478f64554f4519?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SD Times","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SD Times","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/d803c981e67b4edf928840534e1e1382","url":"https://daily.dev/sources/sdtimes"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/broadcom-introduces-truesource-for-open-source-software-security-op8y9uxa1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source,spring,vmware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SD Times","item":"https://daily.dev/sources/sdtimes"},{"@type":"ListItem","position":3,"name":"Broadcom Introduces TrueSource for Open-Source Software Security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/broadcom-introduces-truesource-for-open-source-software-security-op8y9uxa1#faq","mainEntity":[{"@type":"Question","name":"What percentage of AI-generated security patches actually fixed the vulnerability without breaking anything else?","acceptedAnswer":{"@type":"Answer","text":"Only 26 percent of AI-generated patches successfully fixed the security issue without causing other application errors, according to research from 1Password's Off-by-1 Labs that tested 6,000 AI-generated patches. Broadcom cited this finding to argue that current AI tools are not yet reliable enough to replace human oversight in critical security patching tasks. Teams weighing AI-driven versus human-verified patching workflows can track findings like this on daily.dev."}},{"@type":"Question","name":"What is Broadcom's TrueSource product for open-source software security?","acceptedAnswer":{"@type":"Answer","text":"TrueSource is a Broadcom software suite announced at VMware Explore 2026 that provides enterprise support and human-verified security for open-source dependencies. It has three parts: Spring Enterprise for hand-checked Spring patches issued per release line, TrueSource Trusted Artifacts covering Java, Python, Node.js libraries and hardened container images like Bitnami, and TrueSource Data Services for PostgreSQL, RabbitMQ, MySQL, and Valkey. Developers evaluating enterprise open-source support options can follow suites like TrueSource on daily.dev."}},{"@type":"Question","name":"Why does Spring Enterprise issue security patches separately from full version upgrades?","acceptedAnswer":{"@type":"Answer","text":"Spring Enterprise decouples security patches from full version upgrades so security teams can apply fixes in hours rather than weeks, avoiding extensive regression testing cycles. Patches are verified by hand and released simultaneously across every supported release line, often before a vulnerability is publicly disclosed, so no version is left unpatched. Spring maintainers balancing patch speed against testing overhead can keep up with changes like this via daily.dev."}}]} ```